MSExchange Transport Agent Installation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects the installation of a Microsoft Exchange Transport Agent by monitoring for the 'Install-TransportAgent' command-line argument. This activity can be used by adversaries to establish persistence on Exchange servers.